~/talk

Community ID Flow Hashing

Talkat FOSDEM 2021 · on Sunday, 2021-02-07· at 17:40· D.sdn· [security, networking]

speaker

name:Christian Kreibich
links:none on file

resources

video:https://video.fosdem.org/2021/D.sdn/sdn_community_id.mp4
slides:https://fosdem.org/2021/schedule/event/sdn_community_id/attachments/slides/4743/export/events/attachments/sdn_community_id/slides/4743/community_id_fosdem21.pdf

summary

Describes the Community ID algorithm and spec (https://github.com/corelight/community-id-spec) that generates short textual hashes to identify network flows for easy correlation across tools. Covers support and implementations in Suricata, Zeek, Wireshark and various programming languages, explains the motivation for using flow-hash string comparisons instead of manual tuple matching, and reports on the standard’s implementation status with a demonstration.

AI-written summary · about

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.